Code Analysis, Cross-Validation and Verified Code Generation in AI4SWEng

Large language models have made it possible to generate working code in seconds, but working code is not the same as good code: Generated output can pass its own tests while still breaking a system’s intended architecture, introducing quality issues that are only caught much later, or quietly reproducing fragments of licensed code from a model’s training data. Task T3.3 of AI4SWEng, led by Innova Integra (INNO), addresses these shortcomings directly. Rather than treating AI-driven code generation as a standalone capability, T3.3 combines it with advanced tools for code-architecture cross-validation, code quality checking, interactive code refinement and code provenance detection into a single dynamically orchestrated pipeline.

The main activities in Task 3.3 of AI4SWEng

Architecture-aware code and architecture analysis

A central part of the task is investigating improvements to AI-driven code analysis and generation alongside a closely related strand on AI-driven architecture analysis. The two are developed together because correctness at the code level is not sufficient on its own. Generated code needs to remain consistent with the proposed architecture, its components, interfaces and design decisions embedded in the system requirements instead of only with the immediate task it was asked to perform. Architecture analysis cross-checks this consistency, helping catch cases where code technically works but drifts away from the structure it is meant to fit into.

Automated quality testing and interactive refinement

Alongside generation, the task develops automated code quality testing and validation, aimed at catching defects, poor practices and inconsistencies before a human reviewer has to or automated deployments are made. This is complemented by an interactive refinement capability, allowing a developer to work with the LLM backend over several rounds rather than accepting a single generated output as final. Together, these two strands are intended to make code quality and refinement part of the generation process itself, rather than a separate step applied afterwards.

Source detection for copyright enforcement

The task also addresses a problem that is often overlooked in AI-assisted coding: where the generated code actually comes from. LLMs trained on large volumes of public code can, under certain conditions, reproduce identifiable fragments from that training data. T3.3 is developing a source detection tool that locates code snippets of definable size within generated output and checks whether they closely match publicly available sources. Where a match is found, the tool retrieves the associated licence documentation so that the licensing context can be reviewed before the code is used. This gives developers visibility into a risk that would otherwise be very difficult to detect manually.

Validating the approach across two use cases

These capabilities are being developed and tested against two different application contexts. The first is general-purpose software development, where a full pipeline covering code generation, testing and architecture alignment is being built and demonstrated for a typical software delivery workflow. The second is code generation for FPGAs, specialised reconfigurable hardware components with tighter correctness constraints and less tolerance for architectural drift than general-purpose software. Validating the same underlying approach against both contexts helps ensure the resulting tools are broadly applicable rather than tuned to a single type of development environment.

Looking ahead

Work on T3.3 is ongoing, with the underlying components for code and architecture analysis currently being developed alongside the quality testing, refinement and source detection tools described above. As these pieces mature, the aim is to bring them together with the other output generated in AI4SWEng to create an integrated toolchain that supports developers not only in generating code faster, but in trusting what that a generated codebase correctly implements complex architecture designs with high-quality code and free from concerns such as misuse of GPL open-source code.

Related articles